Skip to main content

Linux Kernel EUVDEUVD-2026-27667

| CVE-2026-43270 MEDIUM
2026-05-06 Linux GHSA-fgwc-jh8c-45pq
Information Disclosure Linux
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
3.3 LOW

Local driver context with no user interaction; single-cycle reference leak causes gradual memory pressure, not immediate denial of service, warranting A:L rather than A:H.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Analysis Generated
Jul 24, 2026 - 00:45 vuln.today
CVSS changed
May 08, 2026 - 20:07 NVD
5.5 (MEDIUM)
Patch available
May 06, 2026 - 13:32 EUVD
CVE Published
May 06, 2026 - 11:28 nvd
MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove()

In mtk_mdp_probe(), vpu_get_plat_device() increases the reference count of the returned platform device. Add platform_device_put() to prevent reference leak.

AnalysisAI

Reference count leak in the Linux kernel's mtk-mdp (MediaTek Media Data Path) driver allows a local low-privileged user on MediaTek SoC hardware to cause incremental resource exhaustion. The missing platform_device_put() call in mtk_mdp_remove() means each driver removal cycle permanently leaks one reference to the VPU platform device, preventing kernel memory reclamation. No public exploit exists and EPSS sits at 0.02% (7th percentile); patches are confirmed across eight stable kernel branches.

Technical ContextAI

The mtk-mdp driver (drivers/media/platform/mtk-mdp) implements MediaTek's hardware video processing pipeline for SoC platforms. The flaw is a broken acquire/release pairing: vpu_get_plat_device() called during mtk_mdp_probe() increments the reference count of the returned platform device via get_device() semantics, but the symmetric platform_device_put() - which decrements the count via put_device() - is absent in mtk_mdp_remove(). When the reference count never reaches zero, the kernel's kobject/kref subsystem cannot free the underlying device memory or complete teardown. CWE is not formally assigned but this is structurally equivalent to CWE-772 (Missing Release of Resource after Effective Lifetime). The affected CPE is cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*, with the regression introduced at commit c8eb2d7e8202fd9cb912f5d33cc34ede66dcb24a (kernel 4.10) per EUVD data.

RemediationAI

Update to a patched stable kernel release: 5.10.252, 5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.16, 6.19.6, or 7.0. Upstream fix commits are available at git.kernel.org stable trees, including https://git.kernel.org/stable/c/403b7c757ac9f6b2ffb7d00ff4795a245f5e8911 and https://git.kernel.org/stable/c/dd530e29bd514d7187b3e2df8eb2107419c7988f. Ubuntu users should apply the update referenced in USN-8492-1 (https://ubuntu.com/security/notices/USN-8492-1); Red Hat and SUSE users should monitor their respective advisories. On systems where patching is not immediately feasible, blacklisting the mtk-mdp kernel module eliminates exposure: add 'blacklist mtk-mdp' to /etc/modprobe.d/blacklist.conf and reboot. The trade-off is loss of MediaTek hardware video acceleration; this is acceptable on systems that do not rely on the VPU.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

EUVD-2026-27667 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy